Top Banner
Renier Souza SE Manager - South America [email protected] Office : +55(11) 5185-2760
42

tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

Dec 27, 2019

Download

Documents

dariahiddleston
Welcome message from author
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
Page 1: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

Renier SouzaSE Manager - South [email protected] : +55(11) 5185-2760

���������������� ������

������ �������������

Page 2: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 2

������������������������������������������������������������������������������������������������������������������������������������������������������������������������

Everything Connects to the Network

Data/Voice/Video

over

Wired and Wireless Ethernet

Fast and Secure

Everything Connects to the Network

Data/Voice/Video

over

Wired and Wireless Ethernet

Fast and Secure

In 2004, it means.. In 2004, it means..

��������������������

Page 3: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 3

File Xfer Email CAD/CAM Med. Imaging Real Time Video

40.000Mbps

10.000Mbps

1000 Mbps

622 Mbps

155 Mbps

100 Mbps

25 Mbps10 Mbps

4 Mbps

1980 1985 1990 1995 11980 1985 1990 1995 1998 2000 998 2000 2003 20052003 2005

Ethernet

Token Ring

FDDI

ATM 155

ATM 25

ATM 622

Fast Ethernet

GigabitEthernet

��������� ��������!!

������������������������������������������������������������������������������������������������������������������������������������������������������������������������

Page 4: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 4

����"�������������BlackDiamond 10K

Performance and Features

Alpine

Summit Edge/AggregationSummit Edge

BlackDiamond 6800

BD 8800

High Density Gig/10Gig, Gig-PoE, High Performance, Availability

Gig-E to the desktop, aggregation, Data center

Co

re Ag

greg

ation

Ed

ge

Feature Rich, High Performance ASICs

�#���$ �% �� Across the Platforms

BlackDiamond® 8800

Page 5: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 5

�&��'$ ����

Que tal um Switch com :• Alta performance / WireSpeed ?

• Server Load Balance ?

• Full IP : OSPF, BGP, ISIS, Multicast ?

• Suporte a WireSpeed ACLs ?

• Suporte a Web Cache Redirection

• Suporte a ataques DOS

• LPM !!!!!!

Nós já temos isto !!! Série “ i”

Alpine, BlackDiamond, Summit

Nós já temos isto !!! Série “ i”

Alpine, BlackDiamond, Summit

Page 6: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 6

File Xfer Email CAD/CAM Med. Imaging Real Time Video

40.000Mbps

10.000Mbps

1000 Mbps

622 Mbps

155 Mbps

100 Mbps

25 Mbps10 Mbps

4 Mbps

1980 1985 1990 1995 11980 1985 1990 1995 1998 2000 998 2000 2003 20052003 2005

Ethernet

Token Ring

FDDI

ATM 155

ATM 25

ATM 622

Fast Ethernet

GigabitEthernet

��������� ��������!!

10-GigabitEthernet

40-GigabitEthernetFOCUS

Page 7: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 7

% ��(�������)�����

Não se trata somente de portas 10Gig

• Example: flow based architectures não vão escalar com 10 vezes o número de usuários

É necessário inovar em Múltiplas dimensões !!!

Bandwidth

Resiliency

Security

Extensibility

Scalability

Foco dos nossos Concorrentes

Oportunidade

Para

Inovação

Page 8: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 8

������*��'����'�����������$

������������ ��� ��

� ��� � ��� �����������������

�����������������������

� �� ����� ���������� ! � ����������������"

# ��� ���! $������� ���

�% &'(! � ���% ������

) *��! � ���% ������

�� ������) +������� ���

Page 9: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 9

��������+�� �����������,�

OtherProcessesUnaffected

RIPRIP

OSPFOSPF

SNMPSNMP

Modular O/S

Sys. Proc ASys. Proc A

Sys Proc BSys Proc B

- Sys Proc’s- BGP- RIP- OSPF-SNMP

- Sys Proc’s- BGP-- RIPRIP-- OSPFOSPF--SNMPSNMP

Monolithic O/S

All Processes Affected.Full Reboot Required!Outage: 5 minutes

Code ChangeSNMPSNMP

- Sys Proc’s- BGP- RIP- OSPF-- SNMP

- Sys Proc’s- BGP-- RIPRIP-- OSPFOSPF---- SNMPSNMP Code Change

Page 10: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 10

�����������

OSPF BGP

RoutingRouting

TCP/IPTCP/IP

SNMPSNMP Booting &Config

Booting &Config

Device Drivers and Network InterfacesDevice Drivers and Network Interfaces

SecuritySecurityDevice

Management

Device

ManagementL4 (WCR, SLB)L4 (WCR, SLB)

L2 + L3 Control

Protocols

L2 + L3 Control

Protocols

Hardware Abstraction LayerHardware Abstraction Layer

SystemLibrariesSystemLibraries

SNMPSNMP

(1) SNMP process gets into infinite loop.

PROCESS RESTART: • Processes restart WITHOUT rebooting the switch.

Page 11: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 11

�����������

OSPF BGP

RoutingRouting

TCP/IPTCP/IP

Booting &Config

Booting &Config

Device Drivers and Network InterfacesDevice Drivers and Network Interfaces

SecuritySecurityDevice

Management

Device

ManagementL4 (WCR, SLB)L4 (WCR, SLB)

L2 + L3 Control

Protocols

L2 + L3 Control

Protocols

Hardware Abstraction LayerHardware Abstraction Layer

SystemLibrariesSystemLibraries

(1) SNMP process gets into infinite loop.

(2) Multithreaded O/S continues to service other processes.

(3) Watchdog detects problem in SNMP; kills process

(4) O/S re-starts SNMP.

PROCESS RESTART: • Processes restart WITHOUT rebooting the switch.

SNMPSNMP

Page 12: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 12

-����.��

Rule Syntaxentry <entry-name> {

if {<match-conditions>;

} then {

<action>;<action-modifiers>;

}

}Match-condition: values or fields which the packet must contain

Action: what to do if a packet matches the condition(s), accept or deny

Action-modifier: specifies the further actions to be taken, such as count etc.

Exemplo :# -----------------------------------# Permitir Mac Específico# -----------------------------------entry ARPRenier {

if {ethernet-source-address 00:08:74:9F:2C:2A ;} then {permit;count pcrenier;

}}# -----------------------------------# Permitir ARP’s # -----------------------------------

if {ethernet-type 0x806;} then {permit;count permarp;

}}# -----------------------------------# DENY ALL IS THE LAST# -----------------------------------entry default {

if {}

then {deny;count default;

Page 13: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 13 Kernel

-���/�����0�1'��$ ���������"�

��/���Example using an application module consisting of multiple multithreaded processes

2) Application modules can be upgraded during runtime

1) Functionality can be bundled in an application module, still in protected processes

3) Kernel (driver) modules can be loaded during runtimeNew

App

SSHV2 SCPSSHV2

Update

SCP

Update

4) Application modules can be added during runtime

5) Processes are monitored and can be restarted if necessary

Page 14: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 14

�#$ '��

2��-,.�� ���/����������2��-,.�� ���/���Alpine3808:4 # sho iprouteOri Destination Gateway Mtr Flags VLAN Duration

*d 1.1.1.0/24 1.1.1.1 1 U------u--- v1 0d:0h:00m:51s*d 11.1.1.0/24 11.1.1.1 1 U------u--- Mgmt 0d:0h:00m:51s

*d 2.2.2.0/24 2.2.2.1 1 U------u--- v2 0d:0h:00m:51s*s 10.10.10.0/24 2.2.2.2 1 UG---S-um-- v2 0d:0h:00m:51s (Static /24 route)*d 127.0.0.1/8 127.0.0.1 0 U-H----um-- Default 0d:0h:00m:51sAlpine3808:5 #

Alpine3808:5 # sho ipfdbDest IP Addr TblIdx MacIdx Flag Flow MAC Address VLAN Port

--------------- ------ ------ ---- ---- ----------------- ---- ----1.1.1.1 0101.0 5FE3.0 0000 00:01:30:00:6D:00 4093 CPU

2.2.2.1 0102.0 5FE2.0 0000 00:01:30:00:6D:00 4092 CPU2.2.2.2 0202.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2

10.10.10.1 010A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)10.10.10.2 020A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)10.10.10.3 030A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)10.10.10.4 040A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)10.10.10.5 050A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)..10.10.10.99 630A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)10.10.10.100 640A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (Host Entry)

Total: 103 Static: 2 Dynamic: 101IPFDB Aging time: 0 minutes

Alpine3808:6 #Alpine3808:6 # enable ip-subnet-lookup (Enabling IPDA)To be effective, system rebooting is needed* Alpine3808:7 # reboot (Reboot)

Alpine3808:1 # sh iproute

Ori Destination Gateway Mtr Flags VLAN Duration

*d 1.1.1.0/24 1.1.1.1 1 U------u--- v1 0d:0h:00m:14s*d 11.1.1.0/24 11.1.1.1 1 U------u--- Mgmt 0d:0h:00m:14s

*d 2.2.2.0/24 2.2.2.1 1 U------u--- v2 0d:0h:00m:14s

*s 10.10.10.0/24 2.2.2.2 1 UG---S-um-- v2 0d:0h:00m:14s*d 127.0.0.1/8 127.0.0.1 0 U-H----um-- Default 0d:0h:00m:14s

Alpine3808:2 #

Alpine3808:2 # sho ipfdbDest IP Addr TblIdx MacIdx Flag Flow MAC Address VLAN Port (No more host entries)

--------------- ------ ------ ---- ---- ----------------- ---- ----

1.1.1.1 0101.0 5FE3.0 0000 00:01:30:00:6D:00 4093 CPU

2.2.2.1 0102.0 5FE2.0 0000 00:01:30:00:6D:00 4092 CPU2.2.2.2 0202.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2

Total: 3 Static: 2 Dynamic: 1

IPFDB Aging time: 0 minutesAlpine3808:3 #

Alpine3808:3 # show ip-subnet-lookup fdbDest IP Addr TblIdx MacIdx Flag Flow MAC Address VLAN Port

------------------ ------- ------ ---- ---- ----------------- ---- ----10.10.10.0 /24 1000A.0 38B1.0 0000 00:DE:BB:00:00:01 4092 3:2 (IPDA HW entry)Total number of entries = 1IPFDB SUBNET Lookup Maskbits: [24] (Static Subnet mask)

Router

Internet

10.10.10.1

10.10.10.2

10.10.10.3

Mac0000 00:DE:BB:00:00:01

Page 15: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 15

)�����3�� �������������/��$

Existing Traffic Monitoring Techniques:

Nenhuma delas é efetiva para análise detalhada de todo o tráfego.

Tudo é feito em CPU !

Accumulates flow-based accounting dataNetFlow

Looks at 1 packet a second (statistical)sFlow

Counts packetsRMON

Sends data to external capture systemPort Mirroring

How it operatesTechnology

Page 16: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 16

���������0���""�� -����0�4.�-�56��� ��

NetFlow

sFlow

RMON

Mirror Man

agem

ent

Sta

tio

n

Fo

rwar

din

g E

ng

ine

XML

CL

EA

R-F

low

En

gin

e

SNMP / Tunneling

Traffic

Sw

itch

Continuous

Learning

Examination

Action &

Reporting

Network pre-processes traffic before measuring

Network can pinpoint anomalies

• Counters & thresholds

Page 17: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 17

���������������������������2�������

Perimeter

NetworkLAN Interior

Hosts

Page 18: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 18

��"���5��5��'�����������

Engineering Finance Server Farm WLAN

Internet Pros: WAN security, In-line filter

Cons: No LAN visibility

PerimeterPerimeter

Pros: WAN/LAN visibility

Cons: High Bandwidth (10Gbps+)

CoreCore

Pros: Mitigate at source

Cons: No visibility into other points

EndEnd--pointpoint

Challenges: MultiChallenges: Multi --gigabit rates, Increased mobility, Manual mitigation gigabit rates, Increased mobility, Manual mitigation

Page 19: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 19

4.�-�56���������������������� ������������������

����

������������ �������

������� ���������

�� ��������������

�������������

����

����������

��� ���

� ����������

����

����� ������!"��������

�������������� ����� ����

�������������������������

����

����� ������!"

#### �������������� ����� ����

�������������$$��$�����

����������������������

####

Page 20: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 20

4.�-�56���������������������������������

���$��%��������$��%��������$��%��������$��%������� ������ ������ ������ ����

&�'(&�'()��"&��*)��+,��-&��*)���*.(��

���$��%���������$��%���������$��%���������$��%������������������������������� ���� ���� ���� ���

������������������������� ��������������������

������� ��/���0���������������

&�� ��1� � ���0���� ���&����1-���������������� � ���0���� ���&�����1������������ � ���0���� ����0�� ��&�������1���������������������������������� ����

���$��%���������$��%���������$��%���������$��%���������������������-�$�������������-�$�������������-�$�������������-�$��

&$�����2���� ��(���3&����2���� ��(���3&4��$������2���� ��(���3�2+*53�&��������6�����2���� ��(���3&���$��$2�3�2�������3�7$����8&������2�������3�2��0��3�7$����8&�����2���������3

� ��� ��� ��� ��

-�������9-�������9-�������9-�������9

�������� ����������$��������������������� ����������$��������������������� ����������$��������������������� ����������$�������������

���������������������������/�����������������������������/�����������������������������/�����������������������������/��

����������������������������

�������������������������������������� �������������������� �������������������� �������������������� ��������������

$���������������������������$���������������������������$���������������������������$���������������������������

�� ����������������� ����������������� ����������������� ���������������

�������������������������������� ����� ������������������� ����� ������������������� ����� ������������������� ����� �����������

������������� ������������������������� ������������������������� ������������������������� ����������������������������������������

����������������$����:�;�<��!;=����������������$����:�;�<��!;=����������������$����:�;�<��!;=����������������$����:�;�<��!;=

-�����������$�������������-�����������$�������������-�����������$�������������-�����������$�������������

������������������������������ �������� �������� �������� ��

'��'��'��'��

(�(�(�(�

Page 21: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 21

entry CF_SYN_ACK_RULE

{

if {ratio SYN SYN_ACK > 1;}

then {cli "configure mirror add vlan $vlanName";}

else {cli "configure mirror delete vlan $vlanName";}

}

4.�-�56���������������

����������� ���������$������������������������ ���������$������������������������ ���������$������������������������ ���������$�������������

��������� ���������������������������� ���������������������������� ���������������������������� �������������������

������������$���������/���������������������$���������/���������������������$���������/���������������������$���������/���������

�������������������������������������� �������������������� �������������������� �������������������� ��������������

$���������������������������$���������������������������$���������������������������$���������������������������

�� ����������������� ����������������� ����������������� ���������������

�������������������������������� ����� ������������������� ����� ������������������� ����� ������������������� ����� �����������

������������� ������������������������� ������������������������� ������������������������� ����������������������������������������

����������������$����:�;�<��!;=����������������$����:�;�<��!;=����������������$����:�;�<��!;=����������������$����:�;�<��!;=

� ��� ��� ��� ��

-�������9-�������9-�������9-�������9

-�����������$�������������-�����������$�������������-�����������$�������������-�����������$�������������

������������������������������ �������� �������� �������� ��

entry ACL_SYN

{

if {protocol TCP; tcp-flags 0x02;}

then {count SYN;}

}

entry ACL_SYN_ACK

{

if {protocol TCP; tcp-flags 0x12;}

then {count SYN_ACK;}

}

Page 22: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 22

4.�-�56���������� ��������������������������

�� �������

*����������

*��������$

*��������

*�������$

-�*������:���>��������>�

���>����>�?���>���=

�������%������@�A

������������0���

�����

���������0����

�*�>�(��

������������

?�������

(�������0����

B�������0����

C�/����0����

D�B*���������

������������������

$���

EEEE

Page 23: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 23

)�#��7���������4���

6 All New ASICs

4GNSS

6 All New ASICs

4GNSS

=

Industry’s First ExtensibleSwitching Platform

BlackDiamond 10K

+������������ ��� ��

� ��� � ��� �����������������

�����������������������

� �� ����� ���������� ! � ����������������"

# ��� ���! $������� ���

� �����! � ���% ������

) *��! � ���% ������

�� ������) +������� ���

BlackDiamond 8810

Summit 450-24 / 24X

Advanced Asics

Page 24: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 24

2��8��0�1'����������

RFC 2460, Internet Protocol, Version 6 (IPv6) Specification

RFC 2461, Neighbor Discovery for IP Version 6, (IPv6)

RFC 2462, IPv6 Stateless Address Auto configuration - Router Requirements

RFC 2463, Internet Control Message Protocol (ICMPv6) for the IPv6 Specification

RFC 2466, MIB for ICMPv6

RFC 1981, Path MTU Discovery for IPv6, August 1996 - Router requirements

RFC 3513, Internet Protocol Version 6 (IPv6) Addressing Architecture

RFC 3587, Global Unicast Address Format

RFC 2464, Transmission of IPv6 Packets over Ethernet Networks

RFC 2710, IPv6 Multicast Listener Discovery v1 (MLDv1) Protocol

RFC 3810, IPv6 Multicast Listener Discovery v2 (MLDv2) Protocol

RFC 2740, OSPF for IPv6

RFC 2080, RIPng

RFC 2893, Configured Tunnels

RFC 3056, 6to4

Static Unicast routes for IPv6

Telnet over IPv6 transport

SSH-2 over IPv6 transport

Ping over IPv6 transport

Traceroute over IPv6 transport

Page 25: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 25

-������*�-���������0

��$ $ ���9:;<5=:#*���$ $ ���9:;<5=:�

Summit X450-24x - Fiber (SFP) aggregation switch

Summit X450-24t - 10/100/1000Base-T advanced switch

Option slot for XEN card for dual 10-Gigabit uplinks

XOS modular operating system• Advanced Edge license bundled

• Option Core license (BGP/IPV6)

Page 26: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 26

���������������������������2�������

Perimeter

NetworkLAN Interior

Hosts

Page 27: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 27

)�� ����������''������������������

Perimeter

NetworkLAN Interior

Host Threats

Page 28: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 28

���������>��������1��"����-����>Secure Wireless AccessWi-Fi CERTIFIED WPA protection with HW accelerated AES

Network LoginNetwork Login: 802.1X, MAC and web based authentication, Authentication Trap

�������1��"����-���

Prevent abuser or un-authorized device from connecting to the network

Host Integrity CheckingValidate the PC with Trusted Network Connect, Anti-Virus, OS-Patch-level, etc.

Intelligent Network AccessDynamic ACLs for Security and QoS / Based on Network Login

MAC SecurityMAC lock-down and limiting (lock out rogue access points and hubs)

MAC based VLANs (e.g. VoIP phone assigned to voice VLAN)

Wireless Radio TuningPower Adjustment

Detachable directional antenna

Rogue AP DetectionScanning the radio of rogue APs

shut down the AP

Page 29: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 29

-�������������5 ?<=+�#Many variants, standard is extensible. Extreme’s authenticator implementation provides the most popular variants

• MD5, TLS, TTLS

Requires client software/OS support. Most popular clients in compatibility test

• Windows XP (TLS)

• Funk Software Odyssey client (TLS/TTLS)

Uses EAP (Extensible Authentication protocol) as transport protocol

Uses RADIUS authentication servers. Most popular authentication servers in test

• Funk Steel Belted RADIUS (TLS/TTLS), MS-2000 IAS (MD5, TLS)

Standard defines “port-based”. Extreme can do “user based” (multiple supplicants)

3- DHCP

Network

2- EAP-Over-RADIUS

1 -EAPOL

Enterprise Network

Semi-Public Network/Enterprise Edge

Page 30: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 30

4- DHCP

Network3- RADIUS

1 -DHCP

2 - Login

)�����3�.�����@ ���������Control user admission and access rights to a network

• Prevents unauthorized access and network abuse

• 2 modes: “Campus”, “ISP”

No client software is needed, supports PCs, Apple, Unix, …

• DHCP/Browser based, URL-hijacking automatically redirects to login page

• Presents Web interface and requests user login

• Access granted to users authenticated by RADIUS server

Login page text is configurable (HTML body, text), for guest access and localization

Inactivity (configurable) and manual logout for security and accounting

Mode: Campus

• Ideal for “open” networks - Edu, Gov, Healthcare

• VLAN is assigned based on configuration set on RADIUS server, ideal for roaming users

Mode: ISP

• VLAN pre-assigned to port

Page 31: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 31

A�� �2)-�% ��3Switch authenticates via RADIUS (Web-Based or 802.1X based Network Login)

RADIUS server will send authentication• can interact with LDAP for user information and use a central certificate server

• Can supply group or user-based VLAN ID tag

Switch sends traps / syslog on Network Login

EPICenter Policy Manager applies policy• can interact with LDAP directory for policy

Client(Supplicant)

Switch(Authenticator)

RADIUS(Authentication Server)

EPICenter (Optional)(Policy Manager)

LDAP (optional)(Directory)

Certificate Server (optional) (Certificates)

Page 32: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 32

)�����3�.������ ���

Mode: “Campus”

• Ideal for “open” networks - Edu, Gov, Healthcare

• VLAN is assigned based on configuration set on RADIUS server

• ideal for roaming users with different VLAN access needs

• Can use ports even for guest access via an internet-only VLAN

• If users share the port, they need to have the same VLAN assignment as the first authenticated user or will not be let in

Mode: “ISP”

• VLAN pre-assigned to port

• Seamless support even for multiple users on the same port (hotspot)

Page 33: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 33

)�����3�.�����

4$ '� ����������������������2���� ���B�"����.���������������������������������������������������B�"���������

ALL Ports Blocked ALL Ports Blocked

-"����1���.����������������������������������������������-"����1���.����

�Ports Unblocked

�Ports keep in the same vlan�No changes on Vlan Port

�Ports Unblocked

�Ports CHANGE to User Difined Vlan�All vlans must be in the Uplink(s) Port(s)

Page 34: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 34

% �/�����������?<=+�#

Weblogin

802.1x

Vantagens Desvantagens

*Não é necessário configurar ou instalar nada no ClientRecomendação : Redes Corporativas & Usuários Visitantes

*É é necessário configurar ou instalar SW no Client(Ver Sisoper)

*Não é transparente

*Após Configurado é transparenteRecomendação : Redes Corporativas & UsuáriosCorporativos

Ideal : Ambos Simultâneamente na mesma porta.

Page 35: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 35

2�����������)�����3�-���

Network Login

� 802.1x (agent-based)

� Web login (client-less)

� MAC based

� Multiple supplicant support

RADIUS

VLAN

EPICenterPolicy Manager

ACLQoS

Policy based Network AccessActive

Directory

Page 36: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 36

?<=+�#��-��-�������������

�#$ '��

� ����A���2���������4���3���

Switch 802.1x-aware

RADIUS Server

LAN Enforcer

SMS

Remediation Server

Remediation VLAN

Internal VLAN

`

SSA (Desktop User)

SSA (Laptop User)

2. Identity Response

1. Identity Request

3. Identity Request

4. Identity Request

5. EA

P C

hallenge

6. EAP Challenge + HI Challenge

7. EAP Challenge + HI Challenge

8. EAP + HI Challenge Response

9. EAP + HI Challenge Response

10a. 12a, Switch to Remediation VLAN

10b. EA

P C

hallenge 11b. E

AP

Auth R

esult

12b, Switch to Company VLAN

11a. 13, Auth Result

Remediation VLAN

Page 37: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 37

-����

� 4��������

Cases

Page 38: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 38

B���4�$ �������'��CD��0�-/���,=<<<

Page 39: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 39

E���4���$ ��

���B�F��

Metro

Service Providers / Carriers

Enterprise

Goverment

Universidades / Research

Page 40: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 40

CampinasRio de Janeiro

São Paulo

MPLSHVPLS

���G����7��

Page 41: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 41

)�� �7��

Equipamentos Alpine em :• Porto Alegre

• Salvador

• Belo Horizonte

• Fortaleza

• Recife

• Curitiba

• Florianópolis

• Brasília

• Rio de Janeiro

• São Paulo

Programa de Parcerias

• Certificação e treinamento de técnicos

• Utitização anual dos Laboratórios da Extreme para testes avançados

• Inclusao da RNP no CAC (Customer Advisor Council)

Page 42: tche.brtche.br/pdfjulho05/Extreme_Networks-Reuniao-Rede-Tche.pdf · Wi-Fi CERTIFIED WPA protection with HW accelerated AES Network Login Network Login: 802.1X, MAC and web based authentication,

page 42

����� �/������!!!!!!Renier Edward SouzaSE Manager – South [email protected]